rConfig 安全漏洞

rConfig is an open source network device configuration management utility . An insecure privilege vulnerability exists in the chmod command in rConfig version 3.9.6. The vulnerability stems from the fact that after installing rConfig, an apache user can execute chmod as root without a password,...

CVE-2021-41089 `docker cp` allows unexpected chmod of host files

Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby Docker Engine where attempting to copy files using docker cp into a specially-crafted container can result in Unix file permission changes for existing files in the host’s filesystem,...

Privilege Escalation

systemd-cron:sid is vulnerable to privilege escalation. In the cron package, the postinst maintainer script allows for group-crontab-to-root privilege escalation via symlink attacks against unsafe usage of the chown and chmod programs...

Containerd Privilege Escalation

The vulnerability of the chmod command implementation in the container runtime system, Containerd, is related to deficiencies in the isolation of the controlled system area. Exploiting this vulnerability allows a remote attacker to increase their privileges...

CVE-2021-30463

VestaCP through 0.9.8-24 allows attackers to gain privileges by creating symlinks to files for which they lack permissions. After reading the RKEY value from user.conf under the /usr/local/vesta/data/users/admin directory, the admin password can be changed via a...

Default credentials

VestaCP through 0.9.8-24 allows attackers to gain privileges by creating symlinks to files for which they lack permissions. After reading the RKEY value from user.conf under the /usr/local/vesta/data/users/admin directory, the admin password can be changed via a...

CVE-2021-30463

VestaCP

CVE-2021-30463

VestaCP through 0.9.8-24 allows attackers to gain privileges by creating symlinks to files for which they lack permissions. After reading the RKEY value from user.conf under the /usr/local/vesta/data/users/admin directory, the admin password can be changed via a...

CVE-2021-30463: Improper Link Resolution Before File Access

VestaCP through 0.9.8-24 allows attackers to gain privileges by creating symlinks to files for which they lack permissions. After reading the RKEY value from user.conf under the /usr/local/vesta/data/users/admin directory, the admin password can be changed via a...

PT-2021-18739

Name of the Vulnerable Software and Affected Versions VestaCP versions prior to 0.9.8-25 Description The issue allows attackers to gain privileges by creating symlinks to files for which they lack permissions. This can be achieved by reading the RKEY value from user.conf under the...

ClusterLabs Hawk 安全漏洞

ClusterLabs Hawk is a ClusterLabs open source application. It is used to manage and monitor Pacemaker HA clusters. ClusterLabs Hawk has a security vulnerability that allows an attacker to bypass access restrictions to read or modify data using chmod...

Exploit for SQL Injection in Icegram Email_Subscribers_\&_Newsletters

CVE-2019-20361-EXPLOIT There was a flaw in the WordPress plugi...

Unspecified Vulnerability in SolarWinds Serv-U FTP Server

SolarWinds Serv-U FTP Server is a set of U.S. SolarWinds FTP and MFT file transfer software. A security vulnerability exists in SolarWinds Serv-U FTP Server versions prior to 15.2.1 that stems from the server not properly handling CHMOD commands, no details of the vulnerability are provided at th...

CVE-2020-15542

SolarWinds Serv-U FTP server before 15.2.1 mishandles the CHMOD command...

CVE-2020-15542

SolarWinds Serv-U FTP server before 15.2.1 mishandles the CHMOD command...

CVE-2020-15542

SolarWinds Serv-U FTP server before 15.2.1 mishandles the CHMOD command...

CVE-2020-15542

Summary: CVE-2020-15542 affects SolarWinds Serv-U FTP Server prior to version 15.2.1, due to mishandling of the CHMOD command. The connected documents confirm the vendor release of 15.2.1 as a fix (per Serv-U 15-2-1 release notes). Impact (as stated): The CVSS metrics in the reference indicate hi...

CVE-2020-15542: Undefined Security Weakness

SolarWinds Serv-U FTP server before 15.2.1 mishandles the CHMOD command...

PT-2020-14492

Name of the Vulnerable Software and Affected Versions SolarWinds Serv-U FTP server versions prior to 15.2.1 Description The issue is related to the mishandling of the CHMOD command in the SolarWinds Serv-U FTP server. Recommendations For versions prior to 15.2.1, update to version 15.2.1 or later...

CVE-2020-14004

An issue was discovered in Icinga2 before v2.12.0-rc1. The prepare-dirs script run as part of the icinga2 systemd service executes chmod 2750 /run/icinga2/cmd. /run/icinga2 is under control of an unprivileged user by default. If /run/icinga2/cmd is a symlink, then it will by followed and arbitrar...